alchemy 2.0.0-beta.60 → 2.0.0-beta.62

package/src/Cloudflare/Workflows/WorkflowBridge.ts

@@ -3,7 +3,6 @@ import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
 import * as Layer from "effect/Layer";
 import * as Scope from "effect/Scope";
-import { ExecutionContext } from "../../ExecutionContext.ts";
 import { isScopeEjected } from "../Workers/HttpServer.ts";
 import { getWorkerExport } from "../Workers/WorkerBridge.ts";
 import {
@@ -11,6 +10,10 @@ import {
   type WorkflowExport,
   type WorkflowImpl,
   WorkflowStep,
+  WorkflowStepContext,
+  type WorkflowStepConfig,
+  type WorkflowStepEvent,
+  type WorkflowTaskOptions,
 } from "./Workflow.ts";
 
 /**
@@ -36,35 +39,34 @@ export const makeWorkflowBridge =
       stack: { name: string; stage: string };
     },
   ) =>
-  (className: string) =>
-    class WorkflowBridge extends WorkflowEntrypoint {
+  (className: string) => {
+    // One isolate-lifetime layer build shared by every instantiation of this
+    // workflow class — `build` memoizes the built context.
+    const { build } = getWorkerExport<WorkflowExport>({
+      entrypoint,
+      stack,
+      exportName: className,
+    });
+
+    return class WorkflowBridge extends WorkflowEntrypoint {
       readonly fn: Promise<WorkflowImpl<unknown, unknown>>;
 
       constructor(ctx: unknown, env: unknown) {
         super(ctx, env);
 
-        const { globalContext, exported } = getWorkerExport<WorkflowExport>({
-          entrypoint,
-          stack,
-          exportName: className,
-        });
-
-        this.fn = exported.pipe(
-          Effect.flatMap((wf) => wf.make(env)),
-          Effect.provide(globalContext),
-          Effect.runPromise,
+        this.fn = build(() => {}).then(({ context, export: wf }) =>
+          wf.make(env).pipe(Effect.provideContext(context), Effect.runPromise),
         ) as Promise<WorkflowImpl<unknown, unknown>>;
       }
 
       async run(event: any, step: any): Promise<unknown> {
         const fn = await this.fn;
-        // Each run-invocation gets a fresh ExecutionContext (scope + cache),
-        // following the same per-invocation-scope pattern as
-        // `WorkerBridge.processEvent`. `task` threads this into every step via
-        // the surrounding body context, so `@binding` helpers that need it
-        // (e.g. `Drizzle.postgres`) resolve their per-run resources inside
-        // workflow steps. The same scope is also provided as the ambient
-        // `Scope` service, matching the Worker and Durable Object bridges.
+        // Each run-invocation gets a fresh `Scope`, following the same
+        // per-invocation-scope pattern as `WorkerBridge.processEvent`. `task`
+        // threads it into every step via the surrounding body context, so
+        // `@binding` helpers that acquire per-run resources against the
+        // ambient scope (e.g. `Drizzle.postgres`) resolve them inside
+        // workflow steps, matching the Worker and Durable Object bridges.
         const scope = Scope.makeUnsafe();
         const exit = await Effect.runPromiseExit(
           fn(event.payload).pipe(
@@ -76,9 +78,6 @@ export const makeWorkflowBridge =
                 Layer.provideMerge(
                   Layer.succeed(WorkflowStep, wrapWorkflowStep(step)),
                 ),
-                Layer.provideMerge(
-                  Layer.succeed(ExecutionContext, { scope, cache: {} }),
-                ),
                 Layer.provideMerge(Layer.succeed(Scope.Scope, scope)),
               ),
             ),
@@ -104,30 +103,77 @@ export const makeWorkflowBridge =
         throw Cause.squash(exit.cause);
       }
     };
+  };
 
-const wrapWorkflowEvent = (
-  event: any,
-): { payload: unknown; timestamp: Date; instanceId: string } => ({
+const wrapWorkflowEvent = (event: any): WorkflowEventService["Service"] => ({
   payload: event.payload,
   timestamp:
     event.timestamp instanceof Date
       ? event.timestamp
       : new Date(event.timestamp),
   instanceId: event.instanceId ?? "",
+  workflowName: event.workflowName ?? "",
+  schedule: event.schedule,
 });
 
 const wrapWorkflowStep = (step: any): WorkflowStep["Service"] => ({
-  do: <T>(name: string, effect: Effect.Effect<T>): Effect.Effect<T> =>
-    Effect.tryPromise(
-      () => step.do(name, () => Effect.runPromise(effect)) as Promise<T>,
-    ),
+  do: <T>(options: WorkflowTaskOptions<T, any, any>): Effect.Effect<T> => {
+    const { name } = options;
+    // The surrounding body context is already provided in `task`; the bridge
+    // supplies `WorkflowStepContext` and runs the step to completion, so the
+    // effect is fully satisfied (R = never) at this boundary.
+    const effect = options.effect as Effect.Effect<
+      T,
+      never,
+      WorkflowStepContext
+    >;
+    const config = toWorkflowStepConfig(options);
+    const rollbackEffect = options.rollback;
+    const callback = (context: any) =>
+      Effect.runPromise(
+        effect.pipe(
+          Effect.provideService(WorkflowStepContext, {
+            step: context.step,
+            attempt: context.attempt,
+            config: context.config,
+          }),
+        ),
+      );
+    const rollback = rollbackEffect
+      ? {
+          rollback: (context: any) =>
+            Effect.runPromise(
+              rollbackEffect({
+                error: context.error,
+                output: context.output,
+              }) as Effect.Effect<void>,
+            ),
+          rollbackConfig: options.rollbackConfig,
+        }
+      : undefined;
+    return Effect.tryPromise(() => {
+      if (config && rollback) return step.do(name, config, callback, rollback);
+      if (config) return step.do(name, config, callback);
+      if (rollback) return step.do(name, callback, rollback);
+      return step.do(name, callback);
+    });
+  },
   sleep: (name: string, duration: string | number): Effect.Effect<void> =>
     Effect.tryPromise(() => step.sleep(name, duration)),
   sleepUntil: (name: string, timestamp: Date | number): Effect.Effect<void> =>
-    Effect.tryPromise(() =>
-      step.sleepUntil(
-        name,
-        timestamp instanceof Date ? timestamp.toISOString() : timestamp,
-      ),
+    Effect.tryPromise(() => step.sleepUntil(name, timestamp)),
+  waitForEvent: <T>(
+    name: string,
+    options: any,
+  ): Effect.Effect<WorkflowStepEvent<T>> =>
+    Effect.tryPromise(
+      () => step.waitForEvent(name, options) as Promise<WorkflowStepEvent<T>>,
     ),
 });
+
+const toWorkflowStepConfig = (
+  options: WorkflowTaskOptions<any, any, any>,
+): WorkflowStepConfig | undefined => {
+  if (!options.retries && !options.timeout) return undefined;
+  return { retries: options.retries, timeout: options.timeout };
+};

package/src/Cloudflare/Workflows/WorkflowName.ts

@@ -0,0 +1,41 @@
+import * as Effect from "effect/Effect";
+import type { Input } from "../../Input.ts";
+import * as Output from "../../Output.ts";
+import { sha256 } from "../../Util/sha256.ts";
+
+/**
+ * Derive an account-global Workflow name from its unique host Worker name and
+ * exported class. The hash preserves uniqueness when the readable prefix must
+ * be truncated to Cloudflare's 64-character limit.
+ *
+ * @internal
+ */
+export const makeWorkflowName = (
+  scriptName: Input<string>,
+  className: string,
+): Output.Output<string> => {
+  const resolvedScriptName = Effect.isEffect(scriptName)
+    ? scriptName.pipe(Effect.orDie)
+    : scriptName;
+  return Output.asOutput(
+    resolvedScriptName as
+      | string
+      | Output.Output<string>
+      | Effect.Effect<string>,
+  ).pipe(
+    Output.mapEffect((scriptName) => {
+      const base = `${scriptName}-${className}`
+        .toLowerCase()
+        .replaceAll(/[^a-z0-9-]/g, "-");
+      return sha256(base).pipe(
+        Effect.map((hash) => {
+          const suffix = `-${hash.slice(0, 8)}`;
+          // Trim trailing dashes left by mid-name truncation so the result
+          // never contains a `--` seam.
+          const head = base.slice(0, 64 - suffix.length).replace(/-+$/, "");
+          return `${head}${suffix}`;
+        }),
+      );
+    }),
+  );
+};

package/src/Cloudflare/Zaraz/Config.ts

@@ -185,7 +185,9 @@ export type ConfigAttributes = {
  * ```
  */
 export const Config = Object.assign(
-  Resource<Config>("Cloudflare.Zaraz.Config"),
+  Resource<Config>("Cloudflare.Zaraz.Config", {
+    aliases: ["Cloudflare.ZarazConfig"],
+  }),
   {
     /**
      * Define a type-only contract for the events sent through this Zaraz config.
@@ -251,7 +253,10 @@ export const ConfigProvider = () =>
     }),
     read: Effect.fn(function* ({ olds, output }) {
       const zoneId =
-        output?.zoneId ?? (olds ? yield* resolve(olds.zone) : undefined);
+        // `olds.zone` may be `undefined` when a `creating` row was persisted
+        // before upstream Outputs resolved — report "not found" then.
+        output?.zoneId ??
+        (olds?.zone !== undefined ? yield* resolve(olds.zone) : undefined);
       if (!zoneId) return undefined;
       return yield* observe(zoneId);
     }),

package/src/Cloudflare/Zone/Hold.ts

@@ -109,10 +109,13 @@ export const isHold = (value: unknown): value is Hold =>
 // Cloudflare can transiently fail to authenticate a valid token, surfacing as
 // `Forbidden`. Retry with exponential backoff capped at 5s, bounded to ~8
 // attempts so a persistently-unauthorized call still fails fast.
-const forbiddenRetrySchedule = Schedule.exponential("500 millis").pipe(
-  Schedule.either(Schedule.spaced("5 seconds")),
-  Schedule.both(Schedule.recurs(8)),
-);
+const forbiddenRetrySchedule = Schedule.max([
+  Schedule.min([
+    Schedule.exponential("500 millis"),
+    Schedule.spaced("5 seconds"),
+  ]),
+  Schedule.recurs(8),
+]);
 
 export const HoldProvider = () =>
   Provider.succeed(Hold, {

package/src/Cloudflare/Zone/Zone.ts

@@ -190,6 +190,7 @@ export type Zone = Resource<
  */
 export const Zone = Resource<Zone>("Cloudflare.Zone.Zone", {
   defaultRemovalPolicy: "retain",
+  aliases: ["Cloudflare.Zone"],
 });
 
 export const ZoneProvider = () =>

package/src/Command/Dev.ts

@@ -22,8 +22,10 @@ export interface Dev extends Resource<
   DevProps,
   {
     /**
-     * URL extracted from the first matching stdout/stderr line. Best-effort:
-     * `undefined` if no URL appears within 5 seconds.
+     * URL extracted from stdout/stderr. A `localhost`/IP URL (the dev
+     * server's own address) is preferred over any other URL the command
+     * prints; a non-local URL is only used as a fallback if no local one
+     * appears. Best-effort: `undefined` if no URL appears within 5 seconds.
      */
     url: string | undefined;
   }
@@ -37,10 +39,11 @@ export interface Dev extends Resource<
  * The child process runs inside the dev sidecar (see `Command/Local.ts`) so it
  * survives user-code HMR — Alchemy's user process can restart without killing
  * your `npm run dev` server. Its stdout/stderr are mirrored to the terminal
- * (preserving colored output) and each line is scanned for the first
- * `http(s)://…` URL, which is exposed as the `url` output attribute — useful
- * for surfacing a dev server's local URL back out to whatever resource
- * declared this `Dev`.
+ * (preserving colored output) and scanned for an `http(s)://…` URL, favoring
+ * a `localhost`/IP URL (the dev server's own address) over any unrelated URL
+ * the command prints first. The result is exposed as the `url` output
+ * attribute — useful for surfacing a dev server's local URL back out to
+ * whatever resource declared this `Dev`.
  *
  * @resource
  *
@@ -119,6 +122,11 @@ export const DevProviderLocal = () =>
         const child = yield* spawn(props);
 
         let buffer = "";
+        // A non-local URL seen so far (docs link, error page, update notice,
+        // …). Held as a fallback so that if the dev server never prints a
+        // localhost/IP URL we still surface something, but a localhost URL
+        // always wins if one shows up. See issue #695.
+        let fallbackUrl: string | undefined;
         const deferred = yield* Deferred.make<string>();
 
         const mirror = (sink: "stdout" | "stderr") =>
@@ -132,8 +140,13 @@ export const DevProviderLocal = () =>
                 if (Deferred.isDoneUnsafe(deferred)) return;
                 buffer += text;
                 const url = extractUrl(buffer);
-                if (url) {
+                if (!url) return;
+                if (isLocalUrl(url)) {
+                  // The dev server's own address — resolve immediately.
                   Deferred.doneUnsafe(deferred, Effect.succeed(url));
+                } else {
+                  // Keep scanning: a localhost/IP URL may still appear.
+                  fallbackUrl = url;
                 }
               }),
             ),
@@ -147,7 +160,9 @@ export const DevProviderLocal = () =>
           Deferred.await(deferred).pipe(
             Effect.timeoutOrElse({
               duration: "5 seconds",
-              orElse: () => Effect.undefined,
+              // No localhost/IP URL appeared in time — fall back to any other
+              // URL we saw (or `undefined` if the process stayed silent).
+              orElse: () => Effect.succeed(fallbackUrl),
             }),
           ),
           child.exitCode.pipe(
@@ -206,6 +221,13 @@ export const DevProviderLocal = () =>
     }),
   );
 
+// Matches an http(s) URL whose host is `localhost`, an IPv4 address, or a
+// bracketed IPv6 address — i.e. the shape a dev server prints for its own
+// local address. Preferred over any other URL a command might print first
+// (docs links, error pages, update notices). See issue #695.
+const LOCAL_URL_REGEX =
+  /https?:\/\/(?:localhost|\[[0-9a-fA-F:]+\]|(?:\d{1,3}\.){3}\d{1,3})(?::\d+)?[^\s)\],"'`]*/;
+
 // Matches the first plain http(s) URL. Stops at whitespace and at a small
 // set of punctuation typically used to wrap URLs in log output.
 const URL_REGEX = /https?:\/\/[^\s)\],"'`]+/;
@@ -215,5 +237,15 @@ const URL_REGEX = /https?:\/\/[^\s)\],"'`]+/;
 // eslint-disable-next-line no-control-regex
 const ANSI_REGEX = /\x1b\[[0-9;]*m/g;
 
-const extractUrl = (text: string) =>
-  text.replaceAll(ANSI_REGEX, "").match(URL_REGEX)?.[0];
+/**
+ * Extract a URL from `text`, favoring a localhost/IP URL (the dev server's
+ * own address) over any other URL. Returns the first localhost/IP URL if one
+ * is present, otherwise the first plain http(s) URL, otherwise `undefined`.
+ * @internal
+ */
+export const extractUrl = (text: string) => {
+  const clean = text.replaceAll(ANSI_REGEX, "");
+  return clean.match(LOCAL_URL_REGEX)?.[0] ?? clean.match(URL_REGEX)?.[0];
+};
+
+const isLocalUrl = (url: string) => LOCAL_URL_REGEX.test(url);

package/src/Docker/Container.ts

@@ -243,9 +243,14 @@ export const ContainerProvider = () =>
               ),
             );
           if (!info) return undefined;
+          // `olds.image` may be `undefined` when a `creating` row was
+          // persisted before upstream Outputs resolved — fall back to the
+          // live container's actual image.
           const attrs = toContainerAttributes(
             info,
-            normalizeImageRef(olds.image),
+            olds.image !== undefined
+              ? normalizeImageRef(olds.image)
+              : info.Config.Image,
           );
           if (output) return attrs;
           // Without prior state, only adopt a container that carries our
@@ -258,6 +263,10 @@ export const ContainerProvider = () =>
         }),
         diff: Effect.fn(function* ({ id, instanceId, news, olds }) {
           if (!isResolved(news)) return undefined;
+          // An Output-valued `image` doesn't survive a `creating`-state
+          // round-trip (it deserializes as `undefined`) — without comparable
+          // prior create args, let the engine apply its default update logic.
+          if (olds.image === undefined) return undefined;
           const oldArgs = yield* makeCreateArgs(id, olds, instanceId);
           const newArgs = yield* makeCreateArgs(id, news, instanceId);
           if (!Equal.equals(oldArgs, newArgs)) {
@@ -409,5 +418,8 @@ const normalizeDuration = (
 ): string | undefined => {
   if (!input) return undefined;
   const duration = Duration.fromInputUnsafe(input);
-  return Duration.toNanosUnsafe(duration).toString();
+  // Docker parses `--health-*` durations with Go's `time.ParseDuration`, which
+  // requires a unit suffix — a bare nanosecond count is rejected with "missing
+  // unit in duration". `ns` is the lossless Go-duration rendering of the nanos.
+  return `${Duration.toNanosUnsafe(duration).toString()}ns`;
 };

package/src/Drizzle/Postgres.ts

@@ -4,10 +4,21 @@ import type { EffectPgDatabase } from "drizzle-orm/effect-postgres";
 import * as PgDrizzle from "drizzle-orm/effect-postgres";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Redacted from "effect/Redacted";
-import { ExecutionContext } from "../ExecutionContext.ts";
+import type * as Redacted from "effect/Redacted";
+import type * as Scope from "effect/Scope";
 import { proxyChain } from "../Util/proxy-chain.ts";
 
+/**
+ * Per-execution pool memos, keyed on the execution's `Scope` object. Every
+ * bridge (Worker event, Durable Object call, Workflow run, Lambda invoke)
+ * provides a fresh `Scope` per execution, so an entry lives exactly as long
+ * as its execution and is garbage-collected with the scope object.
+ */
+const caches = new WeakMap<
+  Scope.Scope,
+  Map<symbol, Effect.Effect<any, any, any>>
+>();
+
 /**
  * Open a Drizzle/Postgres database from a connection URL using the
  * `drizzle-orm/effect-postgres` integration.
@@ -26,19 +37,20 @@ import { proxyChain } from "../Util/proxy-chain.ts";
  * ```
  *
  * The connect work is deferred until the first query and memoized on the
- * current `ExecutionContext` (`ctx.cache`), so the pool is built at most
- * once per execution — a Worker `fetch`/`queue`/`scheduled` event or a
- * Workflow run — and reused across every query and `task` step in that
- * execution. Yielding the connection string is likewise deferred, so
- * deploy / plan-time invocations (where `WorkerEnvironment` isn't
- * provided) never trigger a real connection attempt.
+ * current execution's `Scope` (`yield* Effect.scope`), so the pool is built
+ * at most once per execution — a Worker `fetch`/`queue`/`scheduled` event, a
+ * Durable Object call, a Workflow run, or a Lambda invocation — and reused
+ * across every query and `task` step in that execution. Yielding the
+ * connection string is likewise deferred, so deploy / plan-time invocations
+ * (where `WorkerEnvironment` isn't provided) never trigger a real connection
+ * attempt.
  *
- * The pool is built against the execution's `Scope` (`ctx.scope`), so its
- * `end` finalizer fires when that scope closes — when the request / run
- * settles, not when the `Cloudflare.Worker` init scope closes. Init runs
- * inside `Effect.scoped` and closes after returning the exports object;
- * building lazily against `ctx.scope` (rather than that init scope) is
- * what keeps later requests from seeing "Cannot use a pool after end".
+ * The pool is built against that same execution scope, so its `end`
+ * finalizer fires when the scope closes — when the request / run settles,
+ * not when the Worker's isolate-lifetime init completes. Wrapping queries in
+ * a nested `Effect.scoped` narrows both the memo and the pool's lifetime to
+ * that block: memo key and finalizer target are always the same scope
+ * object, so they cannot disagree.
  *
  * @binding
  */
@@ -60,16 +72,32 @@ export const postgres = <
       }
     >(
       Effect.gen(function* () {
-        const ctx = yield* ExecutionContext;
-        return yield* (ctx.cache[symbol] ??= yield* Effect.gen(function* () {
-          const pgCtx = yield* Layer.buildWithScope(
-            PgClient.layer({ url: yield* connectionString }),
-            ctx.scope,
-          );
-          return yield* PgDrizzle.makeWithDefaults(config).pipe(
-            Effect.provideContext(pgCtx),
+        const scope = yield* Effect.scope;
+        let cache = caches.get(scope);
+        if (cache === undefined) {
+          caches.set(scope, (cache = new Map()));
+        }
+        let memo = cache.get(symbol);
+        if (memo === undefined) {
+          // `Effect.cached` only allocates the memo cell — the build runs
+          // on first evaluation — so this yield is synchronous and the
+          // fiber cannot be interleaved between the miss check and the
+          // set: a concurrent first query joins this memo (evaluating the
+          // same cached effect) instead of building a second pool.
+          memo = yield* Effect.cached(
+            Effect.gen(function* () {
+              const pgCtx = yield* Layer.buildWithScope(
+                PgClient.layer({ url: yield* connectionString }),
+                scope,
+              );
+              return yield* PgDrizzle.makeWithDefaults(config).pipe(
+                Effect.provideContext(pgCtx),
+              );
+            }),
           );
-        }).pipe(Effect.cached));
+          cache.set(symbol, memo);
+        }
+        return yield* memo;
       }) as Effect.Effect<
         EffectPgDatabase<TRelations> & {
           $client: PgClient.PgClient;

package/src/Drizzle/Schema.ts

@@ -189,15 +189,18 @@ export const SchemaProvider = () =>
           const nodeExecPath = yield* Effect.sync(() => process.execPath);
           const nodeModulesPath = path.join(process.cwd(), "node_modules");
 
+          // drizzle-kit globs the --schema/--out values; Windows backslashes
+          // are treated as glob escapes and match nothing, so pass forward
+          // slashes.
           const args = [
             bin,
             "generate",
             "--dialect",
             dialect === "postgres" ? "postgresql" : dialect,
             "--schema",
-            schemaPath,
+            schemaPath.replaceAll("\\", "/"),
             "--out",
-            out,
+            out.replaceAll("\\", "/"),
           ];
 
           const commandOptions = {
@@ -433,9 +436,13 @@ export const SchemaProvider = () =>
               ? drift.changed
               : drift.sqlStatements.length > 0;
           // Originally `output.out` was an absolute path, which is not portable.
-          // So, we trigger an update to migrate existing resources.
-          // This is safe because `regenerate` is idempotent.
-          return changed || path.isAbsolute(output.out)
+          // So, we trigger an update to migrate existing resources to the
+          // canonical (cwd-relative) form. This is safe because `regenerate`
+          // is idempotent. Compare against the canonical form rather than
+          // testing `isAbsolute`: on Windows a cross-drive `out` can never be
+          // relativized, so its canonical form IS absolute and an isAbsolute
+          // check would flag an update on every deploy.
+          return changed || output.out !== relativeOut(resolveOut(news))
             ? { action: "update" }
             : undefined;
         }),

package/src/GitHub/AuthProvider.ts

@@ -297,9 +297,6 @@ export const GitHubAuth = AuthProviderLayer<
             Console.log(`  source: ${sourceStr}`),
           ]);
         }),
-        Effect.catch((e) =>
-          Console.error(`  Failed to retrieve credentials: ${e}`),
-        ),
       );
 
     return {

package/src/GitHub/Env.ts

@@ -0,0 +1,57 @@
+import * as Array from "effect/Array";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import { flow } from "effect/Function";
+import * as Option from "effect/Option";
+import * as String from "effect/String";
+
+export interface GitHubEnv {
+  /** The commit SHA that triggered the workflow run. */
+  readonly sha: string;
+  /** The repository owner from `GITHUB_REPOSITORY_OWNER`. */
+  readonly owner: string;
+  /** The repository name parsed from `GITHUB_REPOSITORY`. */
+  readonly repository: string;
+  /** The pull request number exported by the Alchemy GitHub Action. */
+  readonly pr: number | undefined;
+}
+
+/**
+ * GitHub Actions metadata for conditional resources in `alchemy.run.ts`.
+ *
+ * Resolves to `undefined` outside GitHub Actions. In GitHub Actions, it reads
+ * `GITHUB_SHA`, `GITHUB_REPOSITORY_OWNER`, `GITHUB_REPOSITORY`, and the optional
+ * `PULL_REQUEST` variable exported by the Alchemy GitHub Action.
+ */
+export const GitHubEnv: Config.Config<GitHubEnv | undefined> = Config.boolean(
+  "GITHUB_ACTIONS",
+).pipe(
+  Config.withDefault(false),
+  // Config has no flatMap in Effect 4; a Config is itself an Effect, so the
+  // enabled branch returns the inner config for mapOrFail to evaluate.
+  Config.mapOrFail(
+    (enabled): Effect.Effect<GitHubEnv | undefined, Config.ConfigError> =>
+      enabled
+        ? Config.all({
+            sha: Config.string("GITHUB_SHA"),
+            owner: Config.string("GITHUB_REPOSITORY_OWNER"),
+            repository: Config.string("GITHUB_REPOSITORY").pipe(
+              Config.mapOrFail(
+                flow(
+                  String.split("/"),
+                  Array.get(1),
+                  Effect.fromOption,
+                  Effect.catchTags({
+                    NoSuchElementError: Effect.die,
+                  }),
+                ),
+              ),
+            ),
+            pr: Config.number("PULL_REQUEST").pipe(
+              Config.option,
+              Config.map(Option.getOrUndefined),
+            ),
+          })
+        : Effect.succeed(undefined),
+  ),
+);

package/src/GitHub/index.ts

@@ -1,6 +1,7 @@
 export * as Auth from "./AuthProvider.ts";
 export * from "./Comment.ts";
 export { GitHubCredentials, fromEnv, fromToken } from "./Credentials.ts";
+export * from "./Env.ts";
 export * from "./Providers.ts";
 export * from "./Repository.ts";
 export * from "./RepositoryEventSource.ts";

package/src/Http.ts

@@ -16,6 +16,17 @@ export type HttpEffect<Req = never> = Effect.Effect<
   HttpServerRequest | Scope | Req
 >;
 
+/**
+ * `effect`'s HttpEffect brands a request scope as "ejected" when ownership
+ * is transferred to a consumer that outlives the handler's return — a
+ * streaming response body, a WebSocket upgrade, an RPC stream. Bridges check
+ * this before their close-on-return path: an ejected scope is closed by its
+ * new owner when it finishes, not by the bridge.
+ */
+const scopeEjected = Symbol.for("effect/http/HttpEffect/scopeEjected");
+
+export const isScopeEjected = (scope: Scope) => scopeEjected in scope;
+
 export const serve = <Req = never>(
   handler: Effect.Effect<
     HttpServerResponse.HttpServerResponse,

package/src/Local/RpcProviderProxy.ts

@@ -65,7 +65,7 @@ const make = Effect.fn(function* (spawnerUrl: string) {
 
   return RpcProviderProxy.of({
     get: Effect.fn(function* (mainUrl, providerName) {
-      const session = yield* cache.lookup(mainUrl);
+      const session = yield* Cache.get(cache, mainUrl);
       const provider = yield* Effect.promise(
         () =>
           session.getProvider(providerName) as ReturnType<

package/src/Neon/AuthProvider.ts

@@ -207,9 +207,6 @@ export const NeonAuth = AuthProviderLayer<
             Console.log(`  source: ${sourceStr}`),
           ]);
         }),
-        Effect.catch((e) =>
-          Console.error(`  Failed to retrieve credentials: ${e}`),
-        ),
       );
 
     return {